<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>010Editor注册license算法分析 | Forgo7ten'blog</title><meta name="keywords" content="Reverse"><meta name="author" content="Forgo7ten"><meta name="copyright" content="Forgo7ten"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="010Editor注册流程分析 ¶   无限试用：   1rm -rf ~&#x2F;.config&#x2F;SweetScape&#x2F;010\ Editor.ini  key 12Name: Forgo7tenLicense: 1f93-56ac-c63e-540d-a9ab 注册完后 Linux：chattr +i 010\ Editor.ini Mac：chflags uchg 010\ Editor.ini V">
<meta property="og:type" content="article">
<meta property="og:title" content="010Editor注册license算法分析">
<meta property="og:url" content="https://forgo7ten.github.io/Reverse/2021/010Editor_registration_process_analysis/index.html">
<meta property="og:site_name" content="Forgo7ten&#39;blog">
<meta property="og:description" content="010Editor注册流程分析 ¶   无限试用：   1rm -rf ~&#x2F;.config&#x2F;SweetScape&#x2F;010\ Editor.ini  key 12Name: Forgo7tenLicense: 1f93-56ac-c63e-540d-a9ab 注册完后 Linux：chattr +i 010\ Editor.ini Mac：chflags uchg 010\ Editor.ini V">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://forgo7ten.gitee.io/store/imgs/12.jpg">
<meta property="article:published_time" content="2021-11-20T16:00:00.000Z">
<meta property="article:modified_time" content="2021-11-20T16:00:00.000Z">
<meta property="article:author" content="Forgo7ten">
<meta property="article:tag" content="Reverse">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="http://forgo7ten.gitee.io/store/imgs/12.jpg"><link rel="shortcut icon" href="/images/favicon.jpg"><link rel="canonical" href="https://forgo7ten.github.io/Reverse/2021/010Editor_registration_process_analysis/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//hm.baidu.com"/><link rel="preconnect" href="//www.clarity.ms"/><link rel="preconnect" href="//fonts.googleapis.com" crossorigin=""/><link rel="preconnect" href="//busuanzi.ibruce.info"/><meta name="google-site-verification" content="8L0ZjthONyq6-m7FniRTH8A7Bh0x-KOPZbKOcNimnYA"/><meta name="baidu-site-verification" content="code-gjVsyPt7yr"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.css" media="print" onload="this.media='all'"><script>var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?b076845d73a4f28b3c7401b2a0a8a9db";
  var s = document.getElementsByTagName("script")[0]; 
  s.parentNode.insertBefore(hm, s);
})();
</script><script>(function(c,l,a,r,i,t,y){
    c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};
    t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;
    y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);
})(window, document, "clarity", "script", "9zbibmmffi");</script><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Titillium+Web&amp;display=swap" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: {"path":"search.xml","languages":{"hits_empty":"找不到您查询的内容：${query}"}},
  translate: {"defaultEncoding":2,"translateDelay":0,"msgToTraditionalChinese":"繁","msgToSimplifiedChinese":"簡"},
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":300},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: true,
    post: false
  },
  runtime: '天',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: {"chs_to_cht":"你已切换为繁体","cht_to_chs":"你已切换为简体","day_to_night":"你已切换为深色模式","night_to_day":"你已切换为浅色模式","bgLight":"#49b1f5","bgDark":"#121212","position":"bottom-left"},
  source: {
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: true,
  isAnchor: true
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: '010Editor注册license算法分析',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2021-11-21 00:00:00'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="Forgo7ten'blog" type="application/atom+xml">
</head><body><div id="loading-box"><div class="loading-left-bg"></div><div class="loading-right-bg"></div><div class="spinner-box"><div class="configure-border-1"><div class="configure-core"></div></div><div class="configure-border-2"><div class="configure-core"></div></div><div class="loading-word">加载中...</div></div></div><div id="web_bg"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/images/avatar.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data is-center"><div class="data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">20</div></a></div><div class="data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">8</div></a></div><div class="data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">6</div></a></div></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/12.jpg')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">Forgo7ten'blog</a></span><div id="menus"><div id="search-button"><a class="site-page social-icon search"><i class="fas fa-search fa-fw"></i><span> 搜索</span></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">010Editor注册license算法分析</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2021-11-20T16:00:00.000Z" title="发表于 2021-11-21 00:00:00">2021-11-21</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2021-11-20T16:00:00.000Z" title="更新于 2021-11-21 00:00:00">2021-11-21</time></span><span class="post-meta-categories"><span class="post-meta-separator">|</span><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Reverse/">Reverse</a></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-wordcount"><i class="far fa-file-word fa-fw post-meta-icon"></i><span class="post-meta-label">字数总计:</span><span class="word-count">2.2k</span><span class="post-meta-separator">|</span><i class="far fa-clock fa-fw post-meta-icon"></i><span class="post-meta-label">阅读时长:</span><span>10分钟</span></span><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="010Editor注册license算法分析"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><h1 id="010Editor注册流程分析">010Editor注册流程分析<a class="header-anchor" href="#010Editor注册流程分析"> ¶ </a></h1>
<blockquote>
<p>无限试用：</p>
  <figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">rm -rf ~/.config/SweetScape/010\ Editor.ini</span><br></pre></td></tr></table></figure>
</blockquote>
<p>key</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">Name: Forgo7ten</span><br><span class="line">License: 1f93-56ac-c63e-540d-a9ab</span><br></pre></td></tr></table></figure>
<p>注册完后</p>
<p>Linux：<code>chattr +i 010\ Editor.ini</code></p>
<p>Mac：<code>chflags uchg 010\ Editor.ini</code></p>
<p>Version: 12.0.1</p>
<h2 id="分析-5">分析<a class="header-anchor" href="#分析-5"> ¶ </a></h2>
<p>通过查找相应字符串<code>&quot;Invalid name or password&quot;</code>定位到关键函数</p>
<h3 id="Verify函数">Verify函数<a class="header-anchor" href="#Verify函数"> ¶ </a></h3>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121173908017.png" alt="image-20211121173908017"></p>
<p>大概流程为</p>
<p>可以发现h157和h158行调用的函数至关重要。</p>
<p>下面的switch是判断其返回值，如果返回值<code>verify_b == 0xDB</code>时，注册成功</p>
<h4 id="verify-mothod-函数">verify_mothod_函数<a class="header-anchor" href="#verify-mothod-函数"> ¶ </a></h4>
<p>其中<code>verify_b = verify_mothod_(qword_7FF7DB0EEE50, 13i64, 18887i64);</code>如下</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121174330736.png" alt="image-20211121174330736"></p>
<p>发现还是通过调用<code>verify_mothod</code>函数的返回值来判断的</p>
<h4 id="verify-mothod函数">verify_mothod函数<a class="header-anchor" href="#verify-mothod函数"> ¶ </a></h4>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121174742053.png" alt="image-20211121174742053"></p>
<p>执行流程：</p>
<ol>
<li>
<p>h48：判断用户名和密码均不为空，开始执行</p>
</li>
<li>
<p>通过h50: encode_password(a1, en_password);函数，将每两位密码合并成一个字节，得到一个长度为10的字节数组(TimeLicense Key) [或者长度为8的字节数组]</p>
</li>
<li>
<p>h51-h59：判断用户名不能等于999</p>
</li>
<li>
<p>h60-h94：</p>
<ol>
<li>用户名前两个字符如果为<code>&quot;Cow&quot;</code>，加密后的password不能为<code>[0xC4, 0x4A, 0x55, 0x59, 0x2A, 0x35, 0xE2, 0xC4, 0x65, 0xAC]</code></li>
<li>用户名前两个字符如果为<code>&quot;JUY&quot;</code>，加密后的password不能为某个数组（有些元素为空）</li>
<li>貌似没什么用</li>
</ol>
</li>
<li>
<p>h95-h100：简单的将编码后的密码数组赋值给变量</p>
</li>
<li>
<p>h101-h184：</p>
<ol>
<li>
<p>这里是对三种license类型的判断。</p>
<p>9c Evaluation Key</p>
<p>fc VersionLicense Key</p>
<p>ac TimeLicense Key</p>
</li>
<li>
<p>重点分析<code>0xac</code>，时间许可证</p>
<ol>
<li>
<p>首先根据en_password的<code>[1][2][5][7]</code>下标通过<code>get_count</code>函数解析出授权次数count</p>
<p>其中传入的参数低字节为<code>[5]^[2]</code>，高字节为<code>[7]^[1]</code></p>
<p>然后判断<code>count &lt;=1000</code>，处于<code>[1,1000]</code>才有效</p>
</li>
<li>
<p>然后通过<code>get_days</code>函数解析出过期天数days</p>
<p>传入的第一个参数也同理，三个字节从低到高分别为<code>0^6 4^8 5^9</code></p>
</li>
<li>
<p>之后跳转到<code>LABEL_26</code>，然后通过用户名计算出<code>4 5 6 7</code>下标的字节数组，然后比较，需要相同</p>
</li>
<li>
<p>h124-h146不进入。h147-h155，在这里如果days存在，并且数值大于<code>0x49c7</code>的话，转到成功返回值<code>0x2D</code></p>
</li>
</ol>
</li>
</ol>
</li>
</ol>
<h5 id="encode-password函数">encode_password函数<a class="header-anchor" href="#encode-password函数"> ¶ </a></h5>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121194042153.png" alt="image-20211121194042153"></p>
<p>因为没有用循环来写，看着有些长，但实际上操作还是很简单的</p>
<p>执行流程：</p>
<ol>
<li>h50-h51：判断password的长度，若不等于19或者24，退出</li>
<li>h52-h62：判断password格式，<code>-</code>是不是在各自的位置（<code>4 9 14 19</code>）</li>
<li>h69-h152：除去<code>-</code>，每两个字符合并到一起，首先通过<code>cast_num</code>函数得到相应的数字，最终得到的数字为<code>16*[i]+[i+1]</code>；除去<code>-</code>还有20个字符，两两组合得到一个长度为10的char数组</li>
</ol>
<h6 id="cast-num函数">cast_num函数<a class="header-anchor" href="#cast-num函数"> ¶ </a></h6>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121194517887.png" alt="image-20211121194517887"></p>
<p>将数字0-9转换为<code>0-9</code>，字母不论大小写<code>a-z</code>对应着<code>10-35</code></p>
<h5 id="get-count">get_count<a class="header-anchor" href="#get-count"> ¶ </a></h5>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121194651881.png" alt="image-20211121194651881"></p>
<p>变换比较简单，即<code>count = (((((p5 ^ p2) + ((p7 ^ p1) &lt;&lt; 8)) ^ 0x7892) + 0x4D30) ^ 0x3421 )/0xB</code></p>
<p>其中要正好能被0xb整除，相应的逆过来就是</p>
<p><code>((p5 ^ p2) + ((p7 ^ p1) &lt;&lt; 8)) = count *0xb ^0x3421 - 0x4d30 ^ 0x7892</code></p>
<h5 id="get-days">get_days<a class="header-anchor" href="#get-days"> ¶ </a></h5>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121194706479.png" alt="image-20211121194706479"></p>
<p>逆运算为</p>
<p><code>en_password[6] ^ p0) + ((p5 ^ en_password[9]) &lt;&lt; 16) + ((en_password[8] ^ en_password[4]) &lt;&lt; 8 = a1 = * 0x11) ^ 0xFFE53167) + 0x2C175)) ^ 0x22C078 ^ 0x5B8C27)</code></p>
<h5 id="get-pwd-by-name函数">get_pwd_by_name函数<a class="header-anchor" href="#get-pwd-by-name函数"> ¶ </a></h5>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121195149903.png" alt="image-20211121195149903"></p>
<p>通过用户名、授权数量、到期时间来生成password中的4位，然后进行校验。</p>
<h2 id="注册机编写">注册机编写<a class="header-anchor" href="#注册机编写"> ¶ </a></h2>
<script src="https://gist.github.com/Forgo7ten/60bb03583de389ad17a87efa44871041.js"></script>
<h2 id="爆破">爆破<a class="header-anchor" href="#爆破"> ¶ </a></h2>
<h3 id="old">old<a class="header-anchor" href="#old"> ¶ </a></h3>
<p>整个是通过判断verify_mothod函数的返回值来验证的。可以直接修改该函数的返回值。</p>
<p>为了不影响程序的运行逻辑，我选择了一条程序存在的路径，同时也是最简单的一条。直接在h48，改成强制跳转跳过if语句体，然后将原本的返回值修改为<code>0x2D</code>。</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20211121202911313.png" alt="image-20211121202911313"></p>
<p>这样即实现了随意输入（不能为空，判断空的逻辑在verify函数中）便可以注册了。更不会有弹窗了，但感觉不是很完美。</p>
<hr>
<h3 id="有效爆破">有效爆破<a class="header-anchor" href="#有效爆破"> ¶ </a></h3>
<p>相关patch地址：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br></pre></td><td class="code"><pre><span class="line">version:12.0.1</span><br><span class="line">IDA修改base：0x0</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">① 核心校验注册码</span><br><span class="line"></span><br><span class="line">.text:000000000034A32A                 jmp     loc_34A619      ; Keypatch modified this from:</span><br><span class="line">.text:000000000034A32A                                         ;   jz loc_34A619</span><br><span class="line">.text:000000000034A32A                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line">.text:000000000034A619                 mov     eax, 2Dh ; &#x27;-&#x27;  ; Keypatch modified this from:</span><br><span class="line">.text:000000000034A619                                         ;   mov eax, 93h</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">② 次要核心校验注册码</span><br><span class="line"></span><br><span class="line">.text:000000000034AD83                 jmp     loc_34AE63      ; Keypatch modified this from:</span><br><span class="line">.text:000000000034AD83                                         ;   jz short loc_34AD95</span><br><span class="line">.text:000000000034AD83                                         ;   mov eax, 113h</span><br><span class="line">.text:000000000034AD83                                         ; Keypatch padded NOP to next boundary: 2 bytes</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">----------------------------------------</span><br><span class="line">③ 网络验证函数返回1</span><br><span class="line"></span><br><span class="line">.text:00000000001F7754                 jmp     loc_1F7E35      ; Keypatch modified this from:</span><br><span class="line">.text:00000000001F7754                                         ;   jz loc_1F7E35</span><br><span class="line">.text:00000000001F7754                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line">.text:00000000001F7E35                 mov     eax, 1          ; Keypatch modified this from:</span><br><span class="line">.text:00000000001F7E35                                         ;   mov eax, 0FFFFFFFFh</span><br><span class="line"></span><br><span class="line">去掉(EXPIRED)提示（非必要）</span><br><span class="line"></span><br><span class="line">.text:00000000001F567D                 jmp     short loc_1F5690 ; Keypatch modified this from:</span><br><span class="line">.text:00000000001F567D                                         ;   jns short loc_1F5690</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line"></span><br><span class="line">Single User License</span><br><span class="line"></span><br><span class="line">.text:00000000001F5F53                 jmp     short loc_1F5F66 ; Keypatch modified this from:</span><br><span class="line">.text:00000000001F5F53                                         ;   jnz loc_1F60B1</span><br><span class="line">.text:00000000001F5F53                                         ; Keypatch padded NOP to next boundary: 4 bytes</span><br><span class="line"></span><br><span class="line">Single User</span><br><span class="line">.text:000000000034B173                 nop                     ; Keypatch modified this from:</span><br><span class="line">.text:000000000034B173                                         ;   jnz loc_34B2C2</span><br><span class="line">.text:000000000034B173                                         ; Keypatch padded NOP to next boundary: 5 bytes</span><br><span class="line">.text:000000000034B174                 nop</span><br><span class="line">.text:000000000034B175                 nop</span><br><span class="line">.text:000000000034B176                 nop</span><br><span class="line">.text:000000000034B177                 nop</span><br><span class="line">.text:000000000034B178                 nop</span><br><span class="line"></span><br><span class="line">Single User（非必要）</span><br><span class="line">.text:000000000034B1DF                 nop                     ; Keypatch modified this from:</span><br><span class="line">.text:000000000034B1DF                                         ;   jnz short loc_34B1FC</span><br><span class="line">.text:000000000034B1DF                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line">.text:000000000034B1E0                 nop</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">感觉没必要</span><br><span class="line"></span><br><span class="line">无法连接服务器（③控制）</span><br><span class="line">.text:00000000001F547A                 jmp     loc_1F5575      ; Keypatch modified this from:</span><br><span class="line">.text:00000000001F547A                                         ;   jns loc_1F554A</span><br><span class="line">.text:00000000001F547A                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line">注册码已封禁（③控制）</span><br><span class="line">.text:00000000001F554A                 jmp     short loc_1F5575 ; Keypatch modified this from:</span><br><span class="line">.text:00000000001F554A                                         ;   jnz short loc_1F5575</span><br><span class="line"></span><br><span class="line">注册函数（②控制）</span><br><span class="line"></span><br><span class="line">.text:00000000001F559B                 nop                     ; Keypatch modified this from:</span><br><span class="line">.text:00000000001F559B                                         ;   jnz loc_1F5731</span><br><span class="line">.text:00000000001F559B                                         ; Keypatch padded NOP to next boundary: 5 bytes</span><br><span class="line">.text:00000000001F559C                 nop</span><br><span class="line">.text:00000000001F559D                 nop</span><br><span class="line">.text:00000000001F559E                 nop</span><br><span class="line">.text:00000000001F559F                 nop</span><br><span class="line">.text:00000000001F55A0                 nop</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br></pre></td><td class="code"><pre><span class="line">version:13.0</span><br><span class="line"></span><br><span class="line">IDA修改base：0x0</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">①核心校验注册码</span><br><span class="line"></span><br><span class="line">.text:000000000036E32A                 jmp     loc_36E657      ; Keypatch modified this from:</span><br><span class="line">.text:000000000036E32A                                         ;   jz loc_36E657</span><br><span class="line">.text:000000000036E32A                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line">.text:000000000036E657                 mov     eax, 2Dh ; &#x27;-&#x27;  ; Keypatch modified this from:</span><br><span class="line">.text:000000000036E657                                         ;   mov eax, 93h</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">②次要核心校验注册码</span><br><span class="line"></span><br><span class="line">.text:000000000036EDD3                 jmp     loc_36EEB3      ; Keypatch modified this from:</span><br><span class="line">.text:000000000036EDD3                                         ;   jz short loc_36EDE5</span><br><span class="line">.text:000000000036EDD3                                         ;   mov eax, 113h</span><br><span class="line">.text:000000000036EDD3                                         ; Keypatch padded NOP to next boundary: 2 bytes</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">③ 网络验证函数返回1</span><br><span class="line"></span><br><span class="line">.text:0000000000212984                 jmp     loc_213055      ; Keypatch modified this from:</span><br><span class="line">.text:0000000000212984                                         ;   jz loc_213055</span><br><span class="line">.text:0000000000212984                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line">.text:0000000000213055                 mov     eax, 1          ; Keypatch modified this from:</span><br><span class="line">.text:0000000000213055                                         ;   mov eax, 0FFFFFFFFh</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">③ 美观：去除(EXPIRED)提示</span><br><span class="line"></span><br><span class="line">.text:00000000002108AD                 jmp     short loc_2108C0 ; Keypatch modified this from:</span><br><span class="line">.text:00000000002108AD                                         ;   jns short loc_2108C0</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">④ 美观：修改Single User License</span><br><span class="line"></span><br><span class="line">.text:0000000000211183                 jmp     short loc_211196 ; Keypatch modified this from:</span><br><span class="line">.text:0000000000211183                                         ;   jnz loc_2112E1</span><br><span class="line">.text:0000000000211183                                         ; Keypatch padded NOP to next boundary: 4 bytes</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">.text:000000000036F1C3                 nop                     ; Keypatch modified this from:</span><br><span class="line">.text:000000000036F1C3                                         ;   jnz loc_36F312</span><br><span class="line">.text:000000000036F1C3                                         ; Keypatch padded NOP to next boundary: 5 bytes</span><br><span class="line">.text:000000000036F1C4                 nop</span><br><span class="line"></span><br><span class="line">.text:000000000036F22F                 nop                     ; Keypatch modified this from:</span><br><span class="line">.text:000000000036F22F                                         ;   jnz short loc_36F24C</span><br><span class="line">.text:000000000036F22F                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line"></span><br><span class="line">Address	Length	Original bytes	Patched bytes</span><br><span class="line">00000000002108AD	0x1	79 	EB </span><br><span class="line">0000000000211183	0x6	0F 85 58 01 00 00 	EB 11 90 90 90 90 </span><br><span class="line">0000000000212984	0x4	0F 84 CB 06 	E9 CC 06 00 </span><br><span class="line">0000000000212989	0x1	00 	90 </span><br><span class="line">0000000000213056	0x4	FF FF FF FF 	01 00 00 00 </span><br><span class="line">000000000036E32A	0x4	0F 84 27 03 	E9 28 03 00 </span><br><span class="line">000000000036E32F	0x1	00 	90 </span><br><span class="line">000000000036E658	0x1	93 	2D </span><br><span class="line">000000000036EDD3	0x7	74 10 B8 13 01 00 00 	E9 DB 00 00 00 90 90 </span><br><span class="line">000000000036F22F	0x2	75 1B 	90 90 </span><br><span class="line">000000000066CD8E	0x2	73 65 	67 00 </span><br></pre></td></tr></table></figure>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br></pre></td><td class="code"><pre><span class="line">version:13.0.1</span><br><span class="line"></span><br><span class="line">IDA修改base：0x0</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">①核心校验注册码</span><br><span class="line"></span><br><span class="line">.text:000000000036E50A                 jmp     loc_36E837      ; Keypatch modified this from:</span><br><span class="line">.text:000000000036E50A                                         ;   jz loc_36E837</span><br><span class="line">.text:000000000036E50A                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line">.text:000000000036E837                 mov     eax, 2Dh ; &#x27;-&#x27;  ; Keypatch modified this from:</span><br><span class="line">.text:000000000036E837                                         ;   mov eax, 93h</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">②次要核心校验注册码</span><br><span class="line"></span><br><span class="line">.text:000000000036EFB3                 jmp     loc_36F093      ; Keypatch modified this from:</span><br><span class="line">.text:000000000036EFB3                                         ;   jz short loc_36EFC5</span><br><span class="line">.text:000000000036EFB3                                         ;   mov eax, 113h</span><br><span class="line">.text:000000000036EFB3                                         ; Keypatch padded NOP to next boundary: 2 bytes</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">③ 网络验证函数返回1</span><br><span class="line"></span><br><span class="line">.text:0000000000212B44                 jmp     loc_213215      ; Keypatch modified this from:</span><br><span class="line">.text:0000000000212B44                                         ;   jz loc_213215</span><br><span class="line">.text:0000000000212B44                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line">.text:0000000000213215                 mov     eax, 1          ; Keypatch modified this from:</span><br><span class="line">.text:0000000000213215                                         ;   mov eax, 0FFFFFFFFh</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">③ 美观：去除(EXPIRED)提示</span><br><span class="line"></span><br><span class="line">.text:0000000000210A6D                 jmp     short loc_210A80 ; Keypatch modified this from:</span><br><span class="line">.text:0000000000210A6D                                         ;   jns short loc_210A80</span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line">④ 美观：修改Single User License</span><br><span class="line"></span><br><span class="line">.text:0000000000211343                 jnz     short loc_211356 ; Keypatch modified this from:</span><br><span class="line">.text:0000000000211343                                         ;   jnz loc_2114A1</span><br><span class="line">.text:0000000000211343                                         ; Keypatch padded NOP to next boundary: 4 bytes</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">.text:000000000036F3A3                 nop                     ; Keypatch modified this from:</span><br><span class="line">.text:000000000036F3A3                                         ;   jnz loc_36F4F2</span><br><span class="line">.text:000000000036F3A3                                         ; Keypatch padded NOP to next boundary: 5 bytes</span><br><span class="line"></span><br><span class="line">.text:000000000036F40F                 nop                     ; Keypatch modified this from:</span><br><span class="line">.text:000000000036F40F                                         ;   jnz short loc_36F42C</span><br><span class="line">.text:000000000036F40F                                         ; Keypatch padded NOP to next boundary: 1 bytes</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">---------------------------------------</span><br><span class="line"></span><br><span class="line">Address	Length	Original bytes	Patched bytes</span><br><span class="line">0000000000210A6D	0x1	79 	EB </span><br><span class="line">0000000000211343	0x6	0F 85 58 01 00 00 	75 11 90 90 90 90 </span><br><span class="line">0000000000212B44	0x4	0F 84 CB 06 	E9 CC 06 00 </span><br><span class="line">0000000000212B49	0x1	00 	90 </span><br><span class="line">0000000000213216	0x4	FF FF FF FF 	01 00 00 00 </span><br><span class="line">000000000036E50A	0x4	0F 84 27 03 	E9 28 03 00 </span><br><span class="line">000000000036E50F	0x1	00 	90 </span><br><span class="line">000000000036E838	0x1	93 	2D </span><br><span class="line">000000000036EFB3	0x7	74 10 B8 13 01 00 00 	E9 DB 00 00 00 90 90 </span><br><span class="line">000000000036F3A3	0x6	0F 85 49 01 00 00 	90 90 90 90 90 90 </span><br><span class="line">000000000036F40F	0x2	75 1B 	90 90 </span><br></pre></td></tr></table></figure>
<h3 id="爆破思路">爆破思路<a class="header-anchor" href="#爆破思路"> ¶ </a></h3>
<p>首先定位<code>Invalid name or password. Please enter your name and password exactly as given when you purchased 010 Edit</code>字符串所在的函数A</p>
<ol>
<li>
<p>核心校验注册码</p>
<p>函数A中，找如下代码</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910195013434.png" alt="image-20220910195013434"></p>
<p>进入圈起来的这个函数，修改下图圈起来的跳转为jmp</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910195240506.png" alt="image-20220910195240506"></p>
<p>跳转的地址，改为mov eax,2Dh；也就是修改该函数的返回值为<code>45</code></p>
</li>
<li>
<p>次要核心校验注册码</p>
<p>函数A中，找到如下函数</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910200228268.png" alt="image-20220910200228268"></p>
<p>修改该函数返回值为<code>219</code> <strong>仅改这一处即可</strong></p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910200521733.png" alt="image-20220910200521733"></p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910200732247.png" alt="image-20220910200732247"></p>
</li>
<li>
<p>网络验证函数返回1</p>
<p>同样是函数A的如下代码</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910201511764.png" alt="image-20220910201511764"></p>
<p>第一步</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910201855159.png" alt="image-20220910201855159"></p>
<p>jmp跳转过去的地址，改为1</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910202103250.png" alt="image-20220910202103250"></p>
</li>
<li>
<p>美观：去除(EXPIRED)提示</p>
<p>在函数A的如下代码中，改成jmp</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910203947097.png" alt="image-20220910203947097"></p>
</li>
<li>
<p>美观：修改SingleUserLicense</p>
<ol>
<li>
<p>修改注册窗口的字符串</p>
<p>搜索字符串<code>Registered - Single User License</code>，修改跳转跳到这里</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910205517447.png" alt="image-20220910205517447"></p>
</li>
<li>
<p>修改其余</p>
<p>搜索字符串<code>Licensed to:\n</code></p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910210757690.png" alt="image-20220910210757690"></p>
<p>在不远的下方有一个Single，将跳转nop掉</p>
<p><img src= "" data-lazy-src="/Reverse/2021/010Editor_registration_process_analysis/image-20220910211326025.png" alt="image-20220910211326025"></p>
</li>
</ol>
</li>
</ol>
</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="mailto:undefined">Forgo7ten</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="https://forgo7ten.github.io/Reverse/2021/010Editor_registration_process_analysis/">https://forgo7ten.github.io/Reverse/2021/010Editor_registration_process_analysis/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="https://Forgo7ten.github.io" target="_blank">Forgo7ten'blog</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"><a class="post-meta__tags" href="/tags/Reverse/">Reverse</a></div><div class="post_share"><div class="social-share" data-image="http://forgo7ten.gitee.io/store/imgs/12.jpg" data-sites="facebook,twitter,wechat,weibo,qq"></div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/social-share.js/dist/css/share.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/social-share.js/dist/js/social-share.min.js" defer></script></div></div><div class="post-reward"><div class="reward-button"><i class="fas fa-qrcode"></i> 打赏</div><div class="reward-main"><ul class="reward-all"><li class="reward-item"><a href="/images/wechat.png" target="_blank"><img class="post-qr-code-img" src="/images/wechat.png" alt="wechat"/></a><div class="post-qr-code-desc">wechat</div></li><li class="reward-item"><a href="/images/alipay.jpg" target="_blank"><img class="post-qr-code-img" src="/images/alipay.jpg" alt="alipay"/></a><div class="post-qr-code-desc">alipay</div></li></ul></div></div><nav class="pagination-post" id="pagination"><div class="prev-post pull-left"><a href="/Reverse/2021/Analysis_of_intent_redirection_derived_from_2021bytectf/"><img class="prev-cover" src="http://forgo7ten.gitee.io/store/imgs/16.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of previous post"><div class="pagination-info"><div class="label">上一篇</div><div class="prev_info">由2021ByteCTF引出的intent重定向浅析</div></div></a></div><div class="next-post pull-right"><a href="/Crack/Some_crack_apps/"><img class="next-cover" src="http://forgo7ten.gitee.io/store/imgs/18.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of next post"><div class="pagination-info"><div class="label">下一篇</div><div class="next_info">对一些app的Crack分析</div></div></a></div></nav><div class="relatedPosts"><div class="headline"><i class="fas fa-thumbs-up fa-fw"></i><span>相关推荐</span></div><div class="relatedPosts-list"><div><a href="/Reverse/2020/Base64_coding_learning/" title="Base16,Base32,Base64编码详细学习"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/11.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2020-01-15</div><div class="title">Base16,Base32,Base64编码详细学习</div></div></a></div></div></div><hr/><div id="post-comment"><div class="comment-head"><div class="comment-headline"><i class="fas fa-comments fa-fw"></i><span> 评论</span></div></div><div class="comment-wrap"><div><div id="gitalk-container"></div></div></div></div></div><div class="aside-content" id="aside-content"><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#010Editor%E6%B3%A8%E5%86%8C%E6%B5%81%E7%A8%8B%E5%88%86%E6%9E%90"><span class="toc-number">1.</span> <span class="toc-text">010Editor注册流程分析</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%88%86%E6%9E%90-5"><span class="toc-number">1.1.</span> <span class="toc-text">分析</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#Verify%E5%87%BD%E6%95%B0"><span class="toc-number">1.1.1.</span> <span class="toc-text">Verify函数</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#verify-mothod-%E5%87%BD%E6%95%B0"><span class="toc-number">1.1.1.1.</span> <span class="toc-text">verify_mothod_函数</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#verify-mothod%E5%87%BD%E6%95%B0"><span class="toc-number">1.1.1.2.</span> <span class="toc-text">verify_mothod函数</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#encode-password%E5%87%BD%E6%95%B0"><span class="toc-number">1.1.1.2.1.</span> <span class="toc-text">encode_password函数</span></a><ol class="toc-child"><li class="toc-item toc-level-6"><a class="toc-link" href="#cast-num%E5%87%BD%E6%95%B0"><span class="toc-number">1.1.1.2.1.1.</span> <span class="toc-text">cast_num函数</span></a></li></ol></li><li class="toc-item toc-level-5"><a class="toc-link" href="#get-count"><span class="toc-number">1.1.1.2.2.</span> <span class="toc-text">get_count</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#get-days"><span class="toc-number">1.1.1.2.3.</span> <span class="toc-text">get_days</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#get-pwd-by-name%E5%87%BD%E6%95%B0"><span class="toc-number">1.1.1.2.4.</span> <span class="toc-text">get_pwd_by_name函数</span></a></li></ol></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%B3%A8%E5%86%8C%E6%9C%BA%E7%BC%96%E5%86%99"><span class="toc-number">1.2.</span> <span class="toc-text">注册机编写</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E7%88%86%E7%A0%B4"><span class="toc-number">1.3.</span> <span class="toc-text">爆破</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#old"><span class="toc-number">1.3.1.</span> <span class="toc-text">old</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%9C%89%E6%95%88%E7%88%86%E7%A0%B4"><span class="toc-number">1.3.2.</span> <span class="toc-text">有效爆破</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%88%86%E7%A0%B4%E6%80%9D%E8%B7%AF"><span class="toc-number">1.3.3.</span> <span class="toc-text">爆破思路</span></a></li></ol></li></ol></li></ol></div></div></div></div></main><footer id="footer" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/12.jpg')"><div id="footer-wrap"><div class="copyright">&copy;2020 - 2023 By Forgo7ten</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div><div class="footer_custom_text">Hi, welcome to my <a href="https://Forgo7ten.github.io/">blog</a>!</div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="translateLink" type="button" title="简繁转换">繁</button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><a id="to_comment" href="#post-comment" title="直达评论"><i class="fas fa-comments"></i></a><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div id="local-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">本地搜索</span><span id="loading-status"></span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="is-center" id="loading-database"><i class="fas fa-spinner fa-pulse"></i><span>  数据库加载中</span></div><div class="search-wrap"><div id="local-search-input"><div class="local-search-box"><input class="local-search-box--input" placeholder="搜索文章" type="text"/></div></div><hr/><div id="local-search-results"></div></div></div><div id="search-mask"></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="/js/tw_cn.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.js"></script><script src="https://cdn.jsdelivr.net/npm/instant.page/instantpage.min.js" type="module"></script><script src="https://cdn.jsdelivr.net/npm/vanilla-lazyload/dist/lazyload.iife.min.js"></script><script src="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.js"></script><script src="/js/search/local-search.js"></script><script>var preloader = {
  endLoading: () => {
    document.body.style.overflow = 'auto';
    document.getElementById('loading-box').classList.add("loaded")
  },
  initLoading: () => {
    document.body.style.overflow = '';
    document.getElementById('loading-box').classList.remove("loaded")

  }
}
window.addEventListener('load',preloader.endLoading())</script><div class="js-pjax"><script>function addGitalkSource () {
  const ele = document.createElement('link')
  ele.rel = 'stylesheet'
  ele.href= 'https://cdn.jsdelivr.net/npm/gitalk/dist/gitalk.min.css'
  document.getElementsByTagName('head')[0].appendChild(ele)
}

function loadGitalk () {
  function initGitalk () {
    var gitalk = new Gitalk(Object.assign({
      clientID: '9e01c692fcf5a9e47867',
      clientSecret: '6d5297eda0643a171a9e5510f5ea1c29ad851389',
      repo: 'Forgo7ten.github.io',
      owner: 'Forgo7ten',
      admin: ['Forgo7ten'],
      id: '85b6b4369d763c73ce27311d916261f7',
      updateCountCallback: commentCount
    },{"language":"en","perPage":20,"distractionFreeMode":true,"pagerDirection":"last","createIssueManually":true}))

    gitalk.render('gitalk-container')
  }

  if (typeof Gitalk === 'function') initGitalk()
  else {
    addGitalkSource()
    getScript('https://cdn.jsdelivr.net/npm/gitalk@latest/dist/gitalk.min.js').then(initGitalk)
  }
}

function commentCount(n){
  let isCommentCount = document.querySelector('#post-meta .gitalk-comment-count')
  if (isCommentCount) {
    isCommentCount.innerHTML= n
  }
}

if ('Gitalk' === 'Gitalk' || !false) {
  if (false) btf.loadComment(document.getElementById('gitalk-container'), loadGitalk)
  else loadGitalk()
} else {
  function loadOtherComment () {
    loadGitalk()
  }
}</script></div><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/activate-power-mode.min.js"></script><script>POWERMODE.colorful = true;
POWERMODE.shake = true;
POWERMODE.mobile = false;
document.body.addEventListener('input', POWERMODE);
</script><script id="click-show-text" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/click-show-text.min.js" data-mobile="false" data-text="ヾ(≧▽≦*)o 点个收藏叭,(*^▽^*),w(ﾟДﾟ)w,ㄟ(≧◇≦)ㄏ,(/≧▽≦)/点个关注叭,Σ(っ °Д °;)っ,(●ˇ∀ˇ●),( •̀ ω •́ )✧,(*/ω＼*),ヽ(*。&gt;Д&lt;)o゜真的不收藏一下嘛,(～o￣3￣)～,ヽ（≧□≦）ノ" data-fontsize="15px" data-random="false" async="async"></script><script src="https://cdn.jsdelivr.net/npm/pjax/pjax.min.js"></script><script>let pjaxSelectors = ["title","#config-diff","#body-wrap","#rightside-config-hide","#rightside-config-show",".js-pjax"]

var pjax = new Pjax({
  elements: 'a:not([target="_blank"])',
  selectors: pjaxSelectors,
  cacheBust: false,
  analytics: false,
  scrollRestoration: false
})

document.addEventListener('pjax:send', function () {

  // removeEventListener scroll 
  window.tocScrollFn && window.removeEventListener('scroll', window.tocScrollFn)
  window.scrollCollect && window.removeEventListener('scroll', scrollCollect)

  typeof preloader === 'object' && preloader.initLoading()
  document.getElementById('rightside').style.cssText = "opacity: ''; transform: ''"
  
  if (window.aplayers) {
    for (let i = 0; i < window.aplayers.length; i++) {
      if (!window.aplayers[i].options.fixed) {
        window.aplayers[i].destroy()
      }
    }
  }

  typeof typed === 'object' && typed.destroy()

  //reset readmode
  const $bodyClassList = document.body.classList
  $bodyClassList.contains('read-mode') && $bodyClassList.remove('read-mode')

})

document.addEventListener('pjax:complete', function () {
  window.refreshFn()

  document.querySelectorAll('script[data-pjax]').forEach(item => {
    const newScript = document.createElement('script')
    const content = item.text || item.textContent || item.innerHTML || ""
    Array.from(item.attributes).forEach(attr => newScript.setAttribute(attr.name, attr.value))
    newScript.appendChild(document.createTextNode(content))
    item.parentNode.replaceChild(newScript, item)
  })

  GLOBAL_CONFIG.islazyload && window.lazyLoadInstance.update()

  typeof chatBtnFn === 'function' && chatBtnFn()
  typeof panguInit === 'function' && panguInit()

  // google analytics
  typeof gtag === 'function' && gtag('config', '', {'page_path': window.location.pathname});

  // baidu analytics
  typeof _hmt === 'object' && _hmt.push(['_trackPageview',window.location.pathname]);

  typeof loadMeting === 'function' && document.getElementsByClassName('aplayer').length && loadMeting()

  // prismjs
  typeof Prism === 'object' && Prism.highlightAll()

  typeof preloader === 'object' && preloader.endLoading()
})

document.addEventListener('pjax:error', (e) => {
  if (e.request.status === 404) {
    pjax.loadUrl('/404.html')
  }
})</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div><script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"model":{"scale":1,"hHeadPos":0.5,"vHeadPos":0.618,"jsonPath":"/live2dw/assets/z16.model.json"},"display":{"superSample":2,"width":200,"height":400,"position":"right","hOffset":0,"vOffset":-20},"mobile":{"show":true,"scale":0.5},"react":{"opacityDefault":0.7,"opacityOnHover":0.2},"log":false});</script></body></html>